Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 07:47
General
-
Target
2024-09-23_2381a4489df6611069121ab2ba4a5272_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2381a4489df6611069121ab2ba4a5272
-
SHA1
75ba3c4309308ffa69c4830a106558ee8921539b
-
SHA256
2f73b01d0cdda8d330f8a35dd9c4ac2dd48c8482290cecb7cf38542cbdc7ff16
-
SHA512
3c781ebe845f2571f2764a19a51c1f4143b800f053007db19fb448fc9aa5f4c3e546b668d8387a93e199b77f8976a18c62556c6b754023515414b72341f92275
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_2381a4489df6611069121ab2ba4a5272_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_2381a4489df6611069121ab2ba4a5272_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\caHgMWf.exeC:\Windows\System\caHgMWf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqsfjlF.exeC:\Windows\System\RqsfjlF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yBeRgHn.exeC:\Windows\System\yBeRgHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MlRlWnf.exeC:\Windows\System\MlRlWnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPaLSlZ.exeC:\Windows\System\GPaLSlZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNlNMZd.exeC:\Windows\System\nNlNMZd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ClBKabR.exeC:\Windows\System\ClBKabR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dCYoyxW.exeC:\Windows\System\dCYoyxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XhZUyxp.exeC:\Windows\System\XhZUyxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntUAxkv.exeC:\Windows\System\ntUAxkv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nQXOGLs.exeC:\Windows\System\nQXOGLs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMgqwdu.exeC:\Windows\System\aMgqwdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NwkmpPn.exeC:\Windows\System\NwkmpPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UApuBIX.exeC:\Windows\System\UApuBIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XtFAJPc.exeC:\Windows\System\XtFAJPc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NTvOjxu.exeC:\Windows\System\NTvOjxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DfxqpIU.exeC:\Windows\System\DfxqpIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgtKXDT.exeC:\Windows\System\vgtKXDT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VpTjJZB.exeC:\Windows\System\VpTjJZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mbRBCGp.exeC:\Windows\System\mbRBCGp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQUemWB.exeC:\Windows\System\MQUemWB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55717555ff585b7e0d15e5074d3adf81a
SHA1ed97ff1159bba8af06b282c669206ee8b4acf4d0
SHA256a6002046659abfdca930204042d93909b4ba406ee764a53c3214e4420799de4e
SHA512e1aeb34673d4cfa3d42d4e1595112a1795a99c3436b6389b145a7836bfe410efdbf3a40d39319527f86ec82d5737a9936f4fc692d8bb2c1dee6ac340345556cb
-
Filesize
5.2MB
MD5c199cf13f6e45668b3c49a6ca5724970
SHA18899340b6aa604c8aad966b7d7ba174de3b279c0
SHA25680f26c9f8c4a2d15abb795e477acfab1bd419164663e0f55b84f0155dc6fe1a3
SHA512cc65e8b4c543b15f5cb40793aad7ea4c27189169238edb002fcbb77e26b6dd0c184c6718883ec22c7f7789ec3e87c27956b2cb303f184fb9bd251e26f2c3dcea
-
Filesize
5.2MB
MD52bfbb8636ff0c06024a666db60ebbdf8
SHA15fb0e87860ce7f15393b6367d7c05a037706cd7e
SHA2568381e4318072fd7c8dc0a242307d52cb7c62899fdf041e2a83a345e43d2c3686
SHA5128f1243fd98f9b670d98a006357bc5d8eb972ce40eba5bb098963fc8fa15a07017fc95d9c8ad5fc4b75f2cf9a2a0fef0adc21820dccd347d2a3547ee2cc26bd40
-
Filesize
5.2MB
MD5b330152d7ec972006cbc3aa89adcfa70
SHA1c003e307ccf6ba1a79dd2fbad725913b7ad9a859
SHA2567cc797ce21d851e06fc4e286f661033e4e202dd733fae6408ef5204f7c49b5d6
SHA5124f192f7e790b8de6fb831b852ec9faee503219f2d4e08abf57190a2d55cb6d798ea34d7af1e9aed5be6f7124691f746e89ad2abeb1666e0bc85454495ae91bac
-
Filesize
5.2MB
MD506a614b651629098f7492bc824f03234
SHA16695fa7ed90a72aaa41d33601aa0ad4f88f7acda
SHA2569572286cd93088a63f792f96e429df057c19503220f6fb0bbb4347f7ec1f2ff1
SHA5120a6aa73378739341d0b9cdb7e1b210efd6e77d991751578ecbe64988590c31709ed896274137298265971446eaaac8aaf54b0ccb981fbc992b4906f53381b48b
-
Filesize
5.2MB
MD5083ff62e976f3faa1cc1d1d3bff5b279
SHA13b701ba6727aa7db08668dff658fa04cf056184d
SHA256aad50995aa76131457fd8db38b6810e97fb1911b55559593eaa99a03d4533cc5
SHA512ab87eea340169c2dd5b98041b5c6fad07103bf92c06434ff76e1881c27321459fdf6ef43aef94d43d6de201aeeedb354daf24ee3a999b24eb8c4a3fa7a740798
-
Filesize
5.2MB
MD57ed43c87bacf94e11c14cacb2d23cc29
SHA1a5428b2f7e480a8344df8f2104d6916aaa141668
SHA2567c91ed90760fe2f6957168072b9198eaf56cfc5bbea4b5e30164351174a88d26
SHA5129a9d1143f20ac431e5daa63677b26b529289bf867d394a8884c328ea849e5661772115c930d9c04a33236a7d2f49b1cf486db222689d50a47b42cb36f38cf9cb
-
Filesize
5.2MB
MD522c8c607a53be37a60ed18e0644791bb
SHA1cb7837bfcb6c21c90debefb06c883bab0fada6a0
SHA256f702ecb60fdc5af9bdb02e73c34be10548b476b5521933af1476af778fbf85a6
SHA512aab905c28d25a84525b77ccdc260a033dfd112a08ab1fbf70983874769c861e65ac45b1170f2a3f3f0bdb98a5edf1f17bbcf8442d29a26f5cddf8700d83b5ce4
-
Filesize
5.2MB
MD55dec3bd47fbaac72b23e11767564d727
SHA19a3532bdd76d2108e0dbc28deaf8f08ff4bf3b25
SHA2566c918eca0df7d34ef87293a3077f11e61a527d5c0c51db3cc4856b951452daee
SHA51211302db6bc94ac9b1034f80c3301a45f78f2173561524f508fa7d080f6a26d6d910ad68e43682c61236e4f67f111c10ffaeba10b20427f8c88b47690f0dd6412
-
Filesize
5.2MB
MD5ebc16c191e1401a166ff8fb13cbed769
SHA10d69a7faebd928be9a3f5e61bf8a98735ed8a2eb
SHA25624e919dd90a3e8c8edd908b4942d0b9d4e6d55dbe1d9ca34909658017a431172
SHA5129c29c1c3a8f96d21276f55861d514ab8202e3087a29a08fff2a27540892c29da18b1786bf8326abe2607e68d6606ba9b79e23fe38c20c1b791683003502589eb
-
Filesize
5.2MB
MD51f98d6f6a93173e88f38156119493f71
SHA149b3272b423179f611f080d9597c5e3246059273
SHA2567e53cfb7c8d9f32524c31265ef0f626497c94b0a29883b2f033b3e6b47531ad7
SHA5126a3119ce9a84612f118b6ebd1ec7adbea9580073dfca52e86bf8887d886b36a42a0510ce7b0708deeeadabc0f7ebef94861e6ab3c9c0d2196abc6ff1f034b380
-
Filesize
5.2MB
MD548378162e41748e08015b4e5171e34fb
SHA1e0cb5ef0054968daf4112c12bdb23dfcf90b3cd3
SHA256ed53d6c7b6c36570af4001aa12cf42ede7cbe17d3b680f29557d6e7ba08b8472
SHA512e00c1a5e8eb216fd9601c93764fc06ded6a721d2efae583efeee4c2f253f318869dc36bf391c112b09a7064f4709299ab1d52f5a8cd63743e1e77e39a5f2c17f
-
Filesize
5.2MB
MD5075819dcedb6aed53f1944357a46d729
SHA12b9219bd785122e1f0e5d49ce91d8f45de81ec53
SHA256fa03b7018f11c4d2eee2837a6f8275ec7a15f616770e9c0ca16db1724edb0010
SHA5126ea3f9a7ef93433c16779dc2c3951c21126e54034846e315e6e450c0cb5e2f10aa124cdbe5e85179e63cab3f93338b59400834cbd715958ed754490d75aa5431
-
Filesize
5.2MB
MD5b470dc56b813f0077c2b57f56456b5d0
SHA17052ba1ffaa89c42816744ff97aa16e2ad2a947f
SHA25615901570edb47d6abf8827f624a9d608e8f9a072dcfe8872a8d36578d9627864
SHA512f4e87956219ec14760c882d016491815f15c770a0d07d1f31c11638690c81ee1decd0afc49ddb949013b60c8c8f449caa5af39783e2c39480f847fe6797d75a1
-
Filesize
5.2MB
MD5bf000149c9820a945f2df7fb3ed3fbd5
SHA1da3803fb78aa243adef549aae4b74397c7c69cf1
SHA256ac785b7da863757e87283b849562c2058fc2164ef6621bd030158ecb157a3cf6
SHA512efafd9a2e5d5f59efedb2ce514efb6c6e8b27ec340a89ac20ee4b1664d5c66a60d980ad278c7d4d7947d0111c75cd7041129ea9e91f03c00b687baf1970c150f
-
Filesize
5.2MB
MD5f83459b0b26b36409553618a339db31d
SHA137eb4069eee0130f4f94fe96c04ad0d7884ca751
SHA2566d0c14e3d534c6fe44f6d5a72b30b981704fff304dae6d9426b2d2cbb1a5696a
SHA512888979384cc212a1cd6fb454ebc488720132d2031c9ab4b8e6105f1f06ba507c91ac954c057b45074f0abca6bca6daf7a1f53e1d3e22a6bb568c5e33a3b6116c
-
Filesize
5.2MB
MD53964e520776e7f49b4d800aeb4487eb7
SHA14d5f32512845d7e5ca0dc31910c4fcea52c0f790
SHA256fa28ab4c6c807ffd0be0e3fb0ddf1f2d886356a905955083b14fd24dd695fb33
SHA51249ae86324facd0023c8952ea59a4fec883ae9d9ed745c41d48addb793ef5ba914b1258753eb3bb2087877944edc07336a0e9aa61f554c81245ef6eda0e6f51a6
-
Filesize
5.2MB
MD53ee4763391036c551dff342ee10afe2a
SHA120eb7e48a4fbf16af732ef6473742a15caf39508
SHA256f9eba514ad57a4271928bbc4db57e9cf5046b93fdfa365b7e694e3773581c3fa
SHA512c45e2fcf02ab3ba5415246c6fa2a6e59049eb8a52938328703bb24c86b82f1714bd00e48688c231a46ca22410f3c5b4fc217ed100c32f2abe9bac85abb99424c
-
Filesize
5.2MB
MD5c1bf89a6ffd10b11494811f4e78ad8f9
SHA1f2fd4e047205b404f333b1bf80d38db984749aee
SHA256f1b5ae8cf0faa904d57445448708a78eb7631bf3955e7bb58954b2c9f10cf9ee
SHA512d6f6ddec40197611dcbd3f1c44879528b88ff63bd28d6409d7b78f5cfa80af203b97be14aa7953fd1048ffa64e532b1a05d974e69ab5dbe35fa4eef4f7089b36
-
Filesize
5.2MB
MD5ac2ada0e707201e757254df4d163008e
SHA12cb5ca530a5a73e874397d343c747029bc43cf03
SHA25623b250df0999daadad2e2433deba67931d0fcbe20e2d4a0817ea2cdb659b197b
SHA512a13911bbc5a04e74369de92e09b027ee6586aef36c3d613432d8e4badb266a9eb8b31840cfe4fb7c1ec919a429fb48c05e5ee1105f0e05fa1a0c41fd01628114
-
Filesize
5.2MB
MD51bcbf660a7ee061643d03b28acc3e8a7
SHA1bdeee27d93cdc6bb6b4243a8714dfb1c104978ae
SHA2563c89883d40dde168c26dd9ad708d267ecb16845a8eaa5dc07913b4fb9748d602
SHA51250da859cd7c8e6dda87de47031c6c3b597b154425329227da9d8ed82ec3f2b9c673e5861ef65300f526e31e6d00ed3fd61f363e3da0b3d3511fe1ad1d14c0972
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB